包简介

Provides information if your SilverStripe application uses dependencies with known vulnerabilities.

README 文档

README

WARNING: As of January 2021, this module no longer works because the underlying service has been shut down (see announcement and discussion).

NOTE: This module is no longer commercially supported in Silverstripe CMS 5 and it does not provide a CMS5-compatible version.

Adds a task which runs a check if any of the dependencies has known security vulnerabilities. It uses the SensioLabs Security Check Web service and the Security Advisories Database.

BSD 3-clause License

Requirements

SilverStripe Framework ^4
SilverStripe QueuedJobs ^4

Suggested Module

This module will automatically amend the SiteSummary report provided by the SilverStripe Maintenance module, adding alerts if security updates are present for installed modules.

Installation

The following installation commands includes schedulding a queuedjob to populate the data. Run the following command to install this package as a development dependency:

composer require bringyourownideas/silverstripe-composer-security-checker 2.x-dev

vendor/bin/sake dev/build
vendor/bin/sake dev/tasks/ProcessJobQueueTask

Usage

The information gets updated via a BuildTask, which in turn can be run via a queuedjob. You will need to set up a scheduled process (e.g. cron) to run either the buildtask directly, or the task to process the queuedjobs queue in order to refresh the information.

Use the information is stored in the SecurityAlert object, and can be consumed as needed. Please be careful how you expose this information. If the SilverStripe Maintenance module is present, a relationship will be connected between Package and SecurityAlert.

Documentation

Please see the user guide section of the SilverStripe Maintenance module.

bringyourownideas/silverstripe-composer-security-checker 适用场景与选型建议

bringyourownideas/silverstripe-composer-security-checker 是一款基于 PHP 开发的 Composer 扩展包，目前已累计 103.94k 次下载、GitHub Stars 达 10，最近一次更新时间为 2018 年 04 月 20 日，在 PHP 生态内属于活跃度较高的组件。

它主要适用于以下技术方向：「security」「composer」「environment」「silverstripe」「vulnerabilities」「updates」等业务场景。在实际项目中，围绕这些方向常见需要落地的问题包括：接口对接、性能调优、并发安全、与既有框架（Laravel / ThinkPHP / Yii / Webman 等）的兼容适配，以及生产环境的日志埋点与稳定性保障。

我们在过去多个企业项目中使用过 bringyourownideas/silverstripe-composer-security-checker 或与其功能相近的方案，如果你在选型或落地过程中遇到问题，例如 版本兼容、二次改造、私有化封装、与内部系统对接、生产 BUG 排查，欢迎联系我们协助评估。

围绕 bringyourownideas/silverstripe-composer-security-checker 我们能提供哪些服务？

定制开发 / 二次开发

基于 bringyourownideas/silverstripe-composer-security-checker 在你已有业务上做功能扩展、字段裁剪、UI 适配、与内部账号 / 权限 / 日志系统的深度对接。

BUG 修复 & 性能优化

线上偶发问题、内存泄漏、慢查询、并发异常等排查修复；针对高流量场景做缓存、队列、索引层面的调优。

项目外包 & 长期维护

承接完整的项目从需求 → 设计 → 开发 → 上线 → 长期运维；也可按月提供技术保姆服务。

yvsm@zunyunkeji.com QQ：316430983 微信：yvsm316 西安尊云信息科技 · 专注 PHP / Go / 分布式系统研发